CVE-2026-16381

CriticalCVSS 9.1

Published: 21/07/2026(UTC)Updated: 24/07/2026(UTC)Translated: 24/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.20%

9th percentile - higher than 9% of all known CVEs

Summary

Same-origin policy bypass in the DNS networking component of Firefox. This issue was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.

Risk Assessment

An attacker could bypass the same-origin policy, potentially leading to data leakage or cross-site attacks.

Recommendation

Immediately update Firefox and Thunderbird to the latest versions.

Original NVD description (English source)

Same-origin policy bypass in the Networking: DNS component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.